OPS-26 Managing Vulnerabilities, Incidents and Crashes - System Hardening
Changed since C5:2020 · formerly OPS-23
Basic criterion
Specified which data types the criterion applies to.
Added requirements for monitoring measures and reporting identified deviations.
Additional criterion
Additional criterion was moved to the basic criterion, however without the requirement of the monitoring or reporting occur automatically.
Wording in C5:2020
Basic criterion
System components in the production environment used to provide the cloud service under the Cloud Service Provider's responsibility are hardened according to generally accepted industry standards. The hardening requirements for each system component are documented.
If non-modifiable ("immutable") images are used, compliance with the hardening specifications as defined in the hardening requirements is checked upon creation of the images. Configuration and log files regarding the continuous availability of the images are retained.
Additional criterion
System components in the Cloud Service Provider's area of responsibility are automatically monitored for compliance with hardening specifications. Deviations from the specifications are automatically reported to the appropriate departments of the Cloud Service Provider for immediate assessment and action.
Basic criterion
System components in the production environment used to provide the cloud service under the cloud service provider's responsibility are hardened according to generally accepted industry standards.
Supplementary information
System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events.
Supplementary information
Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI IT-Grundschutz-Compendium.
The hardening requirements for each system component are documented.
If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.
Configurations and log files (cloud service provider data) regarding the continuous availability of the aforementioned immutable images are retained.
Supplementary information
The configuration and log files for non-modifiable images include e.g.:
- Configuration of the images used with regards to implemented hardening;
- Specifications including version history; and
- Logs for file integrity monitoring of images in productive use.
The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
Supplementary information
System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events.
Supplementary information
Also applies to 05AS
Compliance with hardening specifications can be monitored with e.g. file integrity monitoring.
Identified deviations from these specifications are timely reported to the appropriate departments for immediate assessment and action.
Additional criterion
OPS-26.05AS
Additional, sharpens05BSystem components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
Supplementary information
System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events.
Supplementary information
Also applies to 05B
Compliance with hardening specifications can be monitored with e.g. file integrity monitoring.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that layers of the cloud service which are under their responsibility are hardened according to generally established and accepted industry standards. The hardening specifications applied are derived from a risk assessment of the planned usage of the cloud service.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources